WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
nex-forms-express-wp-form-builder
Published
2024-01-31
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.7 - Missing Authorization via set_read()
Slug
nex-forms-express-wp-form-builder
Published
2024-02-12
Title
NEX-Forms – Ultimate Form Builder < 8.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Slug
nex-forms-express-wp-form-builder
Published
2024-07-05
Title
NEX-Forms – Ultimate Form Builder < 8.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
nex-forms-express-wp-form-builder
Published
2024-09-30
Title
NEX-Forms – Ultimate Form Builder < 8.7.4 - Reflected Cross-Site Scripting
Slug
nex-forms-express-wp-form-builder
Published
2024-12-02
Title
NEX-Forms – Ultimate Form Builder < 8.7.9 - Authenticated (Administrator+) SQL Injection
Slug
nex-forms-express-wp-form-builder
Published
2024-12-24
Title
NEX-Forms < 8.7.16 - Authenticated (Admin+) SQL Injection
Slug
nex-forms-express-wp-form-builder
Published
2025-03-11
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.8.2 - Unauthenticated Sensitive Information Exposure
Slug
nex-forms-express-wp-form-builder
Published
2025-05-07
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.9.2 - Authenticated (Custom) Stored Cross-Site Scripting
Slug
nex-forms-express-wp-form-builder
Published
2025-05-07
Title
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.9.2 - Authenticated (Custom) Limited Code Execution via get_table_records Function
Slug
nex-forms-express-wp-form-builder
Published
2025-08-20
Title
NEX-Forms < 9.1.4 - Cross-Site Request Forgery
Slug
nex-forms-express-wp-form-builder
Published
2025-10-10
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.7 - Authenticated (Admin+) SQL Injection
Slug
nex-forms-express-wp-form-builder
Published
2025-12-19
Title
Nex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSS
Slug
nex-forms-express-wp-form-builder
Published
2026-01-30
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.9 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Slug
nex-forms-express-wp-form-builder
Published
2026-02-04
Title
NEX-Forms < 9.1.8 - Unauthenticated Stored Cross-Site Scripting
Slug
nex-forms-express-wp-form-builder
Published
2026-02-09
Title
NEX-Forms < 9.1.8 - Reflected Cross-Site Scripting
Slug
nex-forms-express-wp-form-builder
Published
2026-03-13
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.10 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license
Slug
nex-forms-express-wp-form-builder
Published
2026-03-14
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.10 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
Slug
nex-forms-express-wp-form-builder
Published
2026-05-02
Title
NEX-Forms < 9.1.12 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
Slug
nex-forms-express-wp-form-builder
Published
2026-05-14
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.13 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
Slug
nex-forms-express-wp-form-builder
Published
2026-07-10
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.2.3 - Unauthenticated Stored Cross-Site Scripting
Slug
nex-forms-express-wp-form-builder
Published
2026-06-26
Title
NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission
Slug
nex-forms-express-wp-form-builder
Published
2026-06-26
Title
NEX-Forms < 9.2.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
Slug
nex-forms-express-wp-form-builder
Published
2026-06-30
Title
NEX-Forms < 9.2.3 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
Slug
nex-forms-express-wp-form-builder
Published
2026-07-02
Title
NEX-Forms < 9.2.3 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter
Slug
nex-forms-express-wp-form-builder
Published
2026-07-10
Title
NEX-Forms < 9.2.3 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action